All Products
Search

This Product

    Simple Log Service:Content template variables (legacy)

    Document Center

    Simple Log Service:Content template variables (legacy)

    Last Updated:Mar 25, 2026

    This topic describes the variables in legacy content templates and how to reference them.

    Reference syntax

    Important

    When you reference a variable, the variable name must be an exact match. If a variable does not exist or is referenced incorrectly, it defaults to an empty string. If the referenced value is an object, it is converted to a JSON string.

    When you configure an action policy, you must select a content template. The content template defines the specific content and subject. In the Content and Subject fields, you can reference template variables by using the ${fieldName} format. When Log Service sends an alert notification, it replaces the template variables in the Content and Subject with actual values. For example, ${project} is replaced with the name of the Project to which the alert rule belongs.

    Available variables

    The following table describes the variables and their reference methods.

    Parameter

    Description

    Type

    Example value

    Reference example

    aliuid

    The ID of the Alibaba Cloud account that owns the Project.

    string

    117918664953****

    An alert rule for user ${aliuid} has been triggered.

    alert_instance_id

    The ID of the triggered alert instance.

    string

    ee16a8f435485f3f-5be6b81edc520-3d6****

    The instance ID is ${alert_instance_id}.

    project

    The Project that contains the alert rule.

    string

    my-project

    An alert rule in the ${project} Project has been triggered.

    alert_id

    The ID of the alert rule. The ID is unique within a Project.

    string

    0fdd88063a611aa114938f9371daeeb6-1671a52****

    The alert rule ID is ${alert_id}.

    alert_type

    The alert type.

    • sls_alert: An alert triggered by an alert rule.

    • sls_pub: An alert from an open alert source.

    string

    sls_alert

    The alert type is ${alert_type}.

    alert_name

    The name of the alert rule.

    string

    Alert Rule new2

    The alert rule ${alert_name} has been triggered.

    next_eval_interval

    The interval before the next evaluation.

    int

    900

    The next evaluation will occur in ${next_eval_interval} seconds.

    alert_time

    The time of the current evaluation.

    int

    1616744734

    The current evaluation time is ${alert_time}.

    fire_time

    The time when the alert was first triggered.

    int

    1616059834

    The alert was first triggered at ${fire_time}.

    status

    The alert status.

    • firing: The alert is active.

    • resolved: Indicates that the alert is resolved. This status triggers a recovery notification.

    string

    firing

    The alert status is ${status}.

    resolve_time

    The time when the alert was resolved.

    • If the alert status is firing, the value is 0.

    • If the alert status is resolved, the value is the time of resolution.

    int

    0

    The alert was resolved at ${resolve_time}.

    results

    An array of query parameters and intermediate results. For details about the fields, see Query data structure.

    array

    		 
    [
{
"store_type": "log",
"region": "cn-hangzhou",
"project": "sls-alert-test",
"store": "test",
"query": "* | select count(1) as cnt",
"start_time": 1616741485,
"end_time": 1616745085,
"dashboard_id": "mydashboard",
"raw_results": [{"cnt": "4"}],
"raw_result_count": 1,
"truncated": false,
"role_arn": ""
}
]

    Start time for the first query: ${results[0].start_time}; end time: ${results[0].end_time}.

    Note

    The 0 is the index of the query result object in the 'results' array.

    labels

    A map of the alert's labels.

    map

    {"env":"test"}

    The alert labels are ${labels}.

    annotations

    A map of the alert's annotations.

    map

    { "title": "Alert Title","desc": "Alert Description" }

    The alert annotations are ${annotations}.

    severity

    The alert severity.

    • 10: Critical

    • 8: High

    • 6: Medium

    • 4: Low

    • 2: Report Only

    int

    10

    The alert severity is ${severity}.

    policy

    The alert policy or action policy. For details about the fields, see Policy structure.

    map

    		 
    {
    "alert_policy_id": "sls.test-alert",
    "action_policy_id": "sls.test-action",
    "use_default": false,
    "repeat_interval": "6m0s"
}

    The alert policy ID is ${policy.alert_policy_id}.

    region

    The region.

    string

    cn-hangzhou

    The alert was triggered in the ${region} region.

    drill_down_query

    The query statement for drill-down analysis. The value is an empty string for custom alerts. This variable is used in content templates for Log Audit Service, Cost Manager, and SLB.

    string

    * | select count(1) as cnt

    The drill-down query is ${drill_down_query}.

    alert_url

    The URL of the alert details page.

    string

    https://sls.console.alibabacloud.com/lognext/project/test-xxxx/alert/alert-1617164106-940166

    The alert URL is ${alert_url}.

    query_url

    The URL for the results page of the first query.

    string

    https://sls-stgnew.console.alibabacloud.com/lognext/project/test-xxx/logsearch/test-alert-access?encode=base64&endTime=1617175989&queryString=KiB8IHNlbGVjdCBjb3VudCgxKSBhcyBjbnQ%3D&queryTimeType=99&startTime=1617175089

    The URL for the first query page is ${query_url}.

    alert_history_dashboard_url

    The URL of the alert history dashboard.

    string

    https://sls.console.alibabacloud.com/lognext/project/test-xx/dashboard/internal-alert-analysis

    The URL for the alert history dashboard is ${alert_history_dashboard_url}.

    condition

    The evaluation expression that triggered the alert, with variables replaced by their actual values and enclosed in square brackets ([]). The format is Count:count_expression; Condition:match_expression.

    string

    Count:[5] > 3;Condition:[example.com]=='example.com'

    The alert evaluation expression is ${condition}.

    raw_condition

    The original evaluation expression before variables are replaced with their actual values. The format is Count:count_expression; Condition:match_expression.

    string

    Count:__count__ > 3;Condition:host=='example.com'

    The original evaluation expression is ${raw_condition}.

    dashboard

    The name of the dashboard associated with the alert.

    string

    mydashboard

    The associated dashboard name is ${dashboard}.

    dashboard_url

    The URL of the dashboard associated with the alert.

    string

    https://sls.console.alibabacloud.com/next/project/myproject/dashboard/mydashboard

    The URL for the associated dashboard is ${dashboard_url}.

    fire_results

    The data that triggered the alert after set operations. A maximum of 100 rows are returned.

    array

    		 
    [{
    "host":example.com",
    "host__1":"example.com",
    "pv":"836",
    "slbid":"slb-02",
    "status":"200"},{
    "host":"example.com",
    "host__1":"example.org",
    "pv":"836",
    "slbid":"slb-02",
    "status":"200"
},{
    "host":"example.com",
    "host__1":"example.com",
    "pv":"836",
    "slbid":"slb-02",
    "status":"200"
},{
    "host":"example.com",
    "host__1":"example.com",
    "pv":"836",
    "slbid":"slb-02",
    "status":"200"
},{
    "host":"example.com",
    "host__1":"example.com",
    "pv":"780",
    "slbid":"slb-01",
    "status":"200"
}]

    The data that triggered the alert is ${fire_results}.

    fire_results_count

    The total number of data rows that triggered the alert. This count may exceed 100, such as after a Cartesian product operation.

    int

    3

    The total number of data rows that triggered the alert is ${fire_results_count}.

    fire_results_as_kv

    The data that triggered the alert after set operations, displayed in the [key1:value1,key2:value2] format. A maximum of 100 rows are returned.

    array

    [host:example.com,pv:836,status:200][host:example.com,pv:780,status:200]

    Details of the data that triggered the alert: ${fire_results_as_kv}.

    Policy structure

    The following table describes the fields available in the policy variable.

    Field

    Description

    Type

    Example

    alert_policy_id

    The ID of the alert policy.

    string

    sls.test-alert

    action_policy_id

    The ID of the action policy specified by the alert rule. This field applies only when the alert policy uses a dynamic action policy.

    string

    sls.test-action

    repeat_interval

    The repeat notification interval. This field applies only when the alert policy uses an action policy.

    string

    4h

    Query data structure

    The following table describes the fields available in each object of the results array.

    Parameter

    Description

    Type

    Example

    role_arn

    The service role used for the query.

    string

    acs:ram::117918664953****:role/aliyunslsalertmonitorrole

    store_type

    The storage type.

    • log: Logs.

    • metric: Time series data.

    • meta: Resource data.

    string

    log

    region

    The region of the target data store.

    This field is empty when the storage type is meta.

    string

    cn-hangzhou

    project

    The Project that contains the target data store.

    This field is empty when the storage type is meta.

    string

    sls-test-alert

    store

    The name of the target data store.

    string

    test-LogStore

    query

    The query statement.

    string

    error | select count(1) as cnt

    start_time

    The start time of the query.

    This field is empty when the storage type is meta.

    int

    2006-01-02 15:04:05

    start_time_ts

    The start time of the query in UNIX timestamp format.

    This field is empty when the storage type is meta.

    int

    1616741485

    end_time

    The end time of the query.

    This field is empty when the storage type is meta.

    int

    2006-01-02 15:04:05

    end_time_ts

    The end time of the query in UNIX timestamp format.

    This field is empty when the storage type is meta.

    int

    1616745085

    dashboard_id

    The ID of the dashboard associated with the query.

    string

    mydashboard

    raw_results

    An array that contains the raw query results. A maximum of 100 rows are returned.

    array

    		 
    [{
    "host":"example.com",
    "slbid":"slb-02",
    "status":"200"
},{
    "host":"example.com",
    "slbid":"slb-01",
    "status":"200"
},{
    "host":"example.com",
    "slbid":"slb-02",
    "status":"306"
},{
    "host":"example.com",
    "slbid":"slb-02",
    "status":"200"
},{
    "host":"example.com",
    "slbid":"slb-01",
    "status":"200"
},{
    "host":"example.com",
    "slbid":"slb-02",
    "status":"200"
}]